Data processing agreement

About this page. RoveHQ wrote this agreement from public guidance: Article 28 GDPR and UK GDPR, the European Commission's Standard Contractual Clauses (Decision (EU) 2021/914), the EDPB's guidelines on controllers and processors, the ICO's International Data Transfer Addendum, and Thailand's PDPA (Sections 37 and 40) and PDPC notifications. It has not been reviewed by a lawyer. Parts marked [to be added] are waiting for our company to be registered.

1. Parties and how this agreement applies

This data processing agreement ("DPA") is between the business that uses RoveHQ ("you", the controller) and [Company legal name — to be added] ("RoveHQ", the processor). It forms part of the terms of service and applies automatically when you use RoveHQ; no signature is needed. If you need a signed copy, email privacy@rovehq.io.

It applies whenever RoveHQ processes personal data for you under the GDPR, UK GDPR, Thailand's Personal Data Protection Act B.E. 2562 (PDPA), or similar laws. Words like personal data, processing, controller, processor, data subject and personal data breach have the meaning those laws give them. If this DPA and the terms disagree on data protection, this DPA wins; if the Standard Contractual Clauses apply and disagree with this DPA, the Clauses win.

Not covered: information RoveHQ controls itself (your account and billing, our website, and the renter list that renters join with their own consent). Our privacy policy covers those.

2. What we process for you

Annex 1 describes the processing: subject matter, duration, nature and purpose, types of personal data and categories of data subjects.

3. RoveHQ's obligations (Article 28(3) GDPR)

RoveHQ will:

1. Instructions. Process personal data only on your documented instructions, which are these terms, this DPA and what you do in RoveHQ, including for transfers to other countries, unless the law requires otherwise (we'll tell you first unless the law forbids it). We'll tell you if we think an instruction breaks data protection law.
2. Confidentiality. Make sure everyone at RoveHQ who can access the data is bound to keep it confidential.
3. Security. Take the technical and organisational measures in Annex 2 (Article 32).
4. Sub-processors. Follow section 5.
5. Data subject requests. Help you answer requests from renters and others to exercise their rights, mainly through tools in RoveHQ (export and delete a customer, download all data). If a request comes to us directly, we'll pass it to you and not answer it ourselves unless you ask.
6. Help with compliance. Help you with security, breach notification, data protection impact assessments and consulting supervisory authorities (Articles 32 to 36), taking into account what we know about the processing.
7. Deletion or return. When you stop using RoveHQ, or when you delete your business, delete the personal data (you can download it first), unless the law requires us to keep it.
8. Audits. Make available the information needed to show we meet Article 28, and allow and contribute to reasonable audits, including inspections, by you or an auditor you appoint (see section 7).

4. Your obligations

You confirm that you have a lawful basis for the personal data you put in RoveHQ, that you've told the people concerned (your privacy notice), and that your instructions comply with the law. You are responsible for the accuracy of the data and for deciding how long to keep it, using the tools RoveHQ provides (deleting customers, automatic deletion of ID photos).

5. Sub-processors

1. You give RoveHQ general authorisation to use the sub-processors listed in Annex 3 and on our sub-processors page.
2. Notice of changes. We tell you at least 30 days before adding or replacing a sub-processor, by email to your account owner and by updating the sub-processors page.
3. Objection. You can object on reasonable data protection grounds within those 30 days by writing to privacy@rovehq.io. We'll try to find a solution (for example, not using that sub-processor for your data). If we can't, you may end your subscription and we'll refund any prepaid, unused period.
4. Each sub-processor is bound by a written contract with data protection obligations at least as protective as this DPA. RoveHQ remains responsible to you for its sub-processors.

6. Personal data breaches

We will notify you without undue delay, and within 48 hours where possible, after becoming aware of a personal data breach affecting your data. We'll tell you what happened, what data and how many people may be affected, the likely consequences and what we're doing about it, and send more information as we learn it. This lets you meet your own 72-hour duty to notify a supervisory authority where required (Article 33 GDPR; Section 37(4) PDPA).

7. Audits

We'll answer reasonable security questionnaires and share summaries of our security measures and our sub-processors' certifications. If that isn't enough, you may audit once a year (or after a breach, or if a supervisory authority requires it), with 30 days' notice, during business hours, under confidentiality, at your cost, in a way that doesn't expose other customers' data.

8. International transfers

RoveHQ stores data in Singapore and some sub-processors process it in the United States and other countries (Annex 3). Where the law requires a transfer safeguard:

1. EU/EEA (and Switzerland) data. The parties agree to the Standard Contractual Clauses adopted by the European Commission in Decision (EU) 2021/914, Module Two (controller to processor), which are incorporated by reference, with these choices: Clause 7 (docking clause) applies; Clause 9 option 2 (general written authorisation, 30 days' notice); Clause 11 optional language does not apply; Clause 13 the supervisory authority of the EU member state where you are established (or, if you are not established in the EU, where your EU representative is, or otherwise where the affected data subjects are); Clauses 17 and 18 the law and courts of Ireland. Annexes I to III of the Clauses are completed by Annexes 1 to 3 of this DPA. Where you are a processor for someone else, Module Three applies in the same way.
2. UK data. The ICO's International Data Transfer Addendum to the EU Standard Contractual Clauses (version B1.0, in force 21 March 2022) is incorporated. Table 1: the parties' details are in this DPA. Table 2: the EU SCCs as described above. Table 3: Annexes 1 to 3 of this DPA. Table 4: either party may end the Addendum as set out in its Section 19.
3. Thai data. Transfers outside Thailand are made under Section 29 of the PDPA and the PDPC's notifications on cross-border transfers (2023), with the safeguards in this DPA, which the parties agree to as contract clauses for that purpose.
4. Supplementary measures. Encryption in transit and at rest, access controls and the other measures in Annex 2. We'll resist and tell you about any government request for your data where the law allows, and disclose only what we're legally forced to.

9. Liability, term and changes

Each party's liability under this DPA follows the limits in the terms of service, except where the law or the Standard Contractual Clauses don't allow that. This DPA lasts as long as RoveHQ processes personal data for you. We may update it to reflect changes in law or our services, with 30 days' notice for changes that reduce your protection.

Annex 1: Description of the processing

Annex 2: Security measures

• Encryption: HTTPS/TLS for all traffic; data encrypted at rest by our database and storage provider.
• Separation: every business's records are kept apart by row-level security rules in the database.
• Files: ID photos, agreements and other documents are stored in private buckets and opened only through signed links that expire.
• Access control: team roles in each business; owner-only settings; RoveHQ staff access only on request, time-limited, logged and visible to the business.
• Secrets: service keys kept on the server only, never in the browser.
• Integrity of agreements: signed agreements are locked against editing, with execution certificates.
• Resilience: managed database with automatic daily backups, which roll off within 30 days.
• Minimisation: optional automatic deletion of renters' ID photos; tools to delete a customer's personal data; AI providers that don't train on the data.
• People: confidentiality duties for everyone with access; least-privilege access to production systems.
• Testing: security reviews of database rules and access paths when features change.

Annex 3: Sub-processors

The current list, with each company's purpose, location and transfer safeguard, is on our sub-processors page, which forms part of this Annex. Changes are notified as described in section 5.